Short answer: several clear signs point to a compromised Gmail account, and there are steps you can take to verify and recover it quickly. Key signs your Gmail may be hacked
- You can’t log in or your password keeps getting rejected.
- You see unfamiliar devices or locations in your Google Account Security activity.
- You notice emails you didn’t write being sent from your account, or your contacts report strange messages from you.
- Your recovery options (alternate email, phone) have changed without your knowledge.
- Filters or forwarding rules were added that send your mail elsewhere.
What to do right now (step-by-step)
- Try to regain access
- Use Google’s account recovery if you’re locked out, and follow the prompts to recover your account.
- If you can sign in, immediately secure your account.
- Secure and review your account
- Go to Your Google Account > Security > Recent security events and Review security events. Look for unfamiliar devices or sign-ins and sign out from all other sessions if needed.
- Check your Passwords section and change your Google password to a strong, unique passphrase. Enable 2-Step Verification (2SV) for an extra layer of protection.
- Verify recovery options: ensure the recovery email and phone number are correct and unchanged.
- Inspect and fix email flow controls
- Gmail Settings > Forwarding and POP/IMAP: remove any unknown forwarding addresses.
- Filters and Blocked Addresses: review for unfamiliar filters that could forward or delete mail.
- Scan for other security gaps
- Use Have I Been Pwned or similar breach-check services to see if your email address appeared in data breaches, and update any reused passwords on other services.
- If you reused passwords on other sites, change them and enable 2FA wherever available.
- Notify contacts and monitor
- Let trusted contacts know your account was compromised so they can be cautious of any suspicious messages they received from you.
Prevention tips for the future
- Keep 2SV enabled, preferably with a hardware key or authenticator app.
- Regularly review security settings and unknown devices in your Google account.
- Use unique passwords for each service and consider a reputable password manager.
- Be cautious of phishing attempts asking for password or recovery info.
If you want, I can tailor these steps to your current access status (can you log in or not, and do you see any unfamiliar devices or changes yet?).
